AWS S3 able to download some objects, but some other objects failed with 403 forbidden

Hi , yes, we have tried like "aws s3 cp s3://{bucket}/{folder}/{filename} .", but it shows "fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden", and the file exists, but when trying another file in the same bucket same folder, it able to download

Are there any differences other than content type between files that can be downloaded and files that cannot be downloaded? For example, is there any difference in the object owner, file size, file extension, etc.? https://docs.aws.amazon.com/AmazonS3/latest/userguide/object-ownership-retrieving.html

Thank you for confirmation. There may have been some problem during upload. I cannot directly check your AWS account, so if you are subscribed to a paid AWS support plan, you may want to contact them there.

Hi Gary, thanks for your info. Currently we enabled s3 gateway endpoint, we are using it directly to download the s3 within the intranet, for some objects in the same bucket, same folder we have this issue, even we use aws s3 cp command, some objects responded: "fatal error: An error occurred (403) when calling the HeadObject operation: Forbidden", but some other objects in same folder/same bucket can access with no issues. we have tried replace this object with same name and same content type then it can download , if we removed the latest version of this object, then it cannot download again.

Hi Gary, Currently our bucket policy are:

{ "Version": "2012-10-17", "Statement": [ { "Sid": "SSLOnly", "Effect": "Deny", "Principal": "", "Action": "s3:", "Resource": [ "arn:aws:s3:::{my_bucket}", "arn:aws:s3:::{my_bucket}/*" ], "Condition": { "Bool": { "aws:SecureTransport": "false" } } }, { "Sid": "S16112775312312", "Effect": "Allow", "Principal": { "AWS": [

                "arn:aws:iam::{my_account_id}:role/{my_iam_role}"
            ]
        },
        "Action": "s3:*",
        "Resource": [
            "arn:aws:s3:::{my_bucket}",
            "arn:aws:s3:::{my_bucket}/*"
        ]
    }
]

}

we have IAM role: "arn:aws:iam::{my_account_id}:role/{my_iam_role}"

the policy in this role specified "s3:*" to ALLOW

What I am access do you have and what’s the bucket policy?